[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Computer Security Division 2015 Annual Report:

In  FY  2016,  NIST  will  continue  to  conduct  stakeholder outreach and will work collaboratively to further understand stakeholder needs regarding tools and resources to enable more effective use of the Framework. NIST will also publish guidance  on  how  NIST's  Risk  Management  Framework (SP  800-37  revision  1)  and  the  Cybersecurity  Framework complement  each  other. Additionally,  NIST  will  formally gather stakeholder input about Framework use, evolution, and future management through a request for information (RFI). Following  the  RFI,  NIST  will  conduct  a  public workshop  at  NIST  in  Gaithersburg,  Maryland  on  April  6 and  7,  2016. Periodic  program  updates  will  be  provided through the Framework website. - Finalize SP 800-16, A Role-Based Model for Federal Information Technology / Cybersecurity Training;
- Begin the development of SP 800-53, Revision 5, Security and Privacy Controls for Federal Information Systems and Organizations;
- Continue to explore ways to use automation to support SP 800-53 updates;
- Continue the development of SP 800-60, Revision 2, Guide for Mapping Types of Information and Information Systems to Security Categories;
- Continue the development of SP 800-18, Revision 2, Guide for Developing Security Plans for Federal Information Systems and Organizations;
- Expand cybersecurity outreach to include additional state, local, and tribal governments, as well as private sector organizations and academic institutions;
- Continue to support federal agencies in the effective implementation of the RMF; and
- Continue collaboration with JTF partners and other federal organizations. In  FY  2015,  Biometric  Conformance  Test  Software (BioCTS) for ANSI/NIST-ITL (which targets biometric transactions based on NIST SP 500-290, and SP 500-290 Revision 1 - Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information) received a substantial update.

Computer Security Division 2015 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1         |                                                                                |
|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|
| 1.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.12 (NIST 3.2.12)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.2.12 of [SP800-63B]). 3.2.12 of [SP800-63B]).

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings:

| 1                  | Introduction ............................................................................................................1   | Introduction ............................................................................................................1   |
|--------------------|------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| 2                  | 1.2                                                                                | About the IoT Cybersecurity Colloquium......................................................... 1                            |
|                    | Summary and Key Takeaways..............................................................................3                     | Summary and Key Takeaways..............................................................................3                     |
|                    | 2.1                                                                                | Defining the Internet of Things........................................................................ 3                    |
|                    | 2.2                                                                                | IoT Cybersecurity and Privacy Risks .............................................................. 3                         |
|                    | 2.3                                                                                | IoT-Specific Risks ...........................................................................................

Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

| Executive Summary..................................................................................................... vi        | Executive Summary..................................................................................................... vi        | Executive Summary..................................................................................................... vi   |
|----------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction ............................................................................................................1    | 1. Introduction ............................................................................................................1    |                                                                                |
|                                                                                | Purpose and Scope                                                                                | ........................................................................................ 1                                  |
|                                                                                | Audience.........................................................................................................

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1 provide?

[Assistant]
<!-- image -->

## The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1

## Recommendations of the National Institute of Standards and Technology

David Waltermire Stephen Quinn Karen Scarfone

NIST Special Publication 800-126 Revision 1

The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1

Recommendations of the National Institute of Standards and Technology

David Waltermire Stephen Quinn Karen Scarfone

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

February 2011

<!-- image -->

U.S. Department of Commerce

Gary Locke, Secretary

National Institute of Standards and Technology

Dr. Patrick D. Gallagher, Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-126, Revision 1 39 pages (Feb.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to U.S. Department of Energy Risk Assessment Methodology:

- . Excessively detailed and lengthy --making it a paper exercise rather than a beneficial management and security awareness process
- . Overly quantitative in approach, thus resulting in an end-product that is difficult to interpret (if not useless)
- Not oriented towards the true "bottom-line": "What is it going to cost to fix the problems identified?"

- . Personnel Management
- . Manufacturing/Control
- . Mathematics/Statistical
- . Security
- . Training

| ucrAK 1 Mcn 1 ur ADP SYSTEM RISK ASSESSMENT   | ucrAK 1 Mcn 1 ur ADP SYSTEM RISK ASSESSMENT                                                                 | CROSS REFERENCE NUMERIC LISTING OF DOE ORDERS USED TO DEVELOP SECURITY REQUIREMENTS                         | STEP 3 RESOURCE TABLE R3 (Page 3)   |
|-----------------------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------|
| OOe:;;::fi::::::.:::: OOCVMeNT NUMBER         | DOE DOCMMBIT TITI^ (A» ^                                                                                | DOE DOCMMBIT TITI^ (A» ^                                                                                | BASELINE REQUIREMENT CODE           |
| 1000.38                                       | INTERNAL CONTROL SYSTEMS                                                                                | INTERNAL CONTROL SYSTEMS                                                                                | K,                                  |
| 1330.18                                       | MANAGEMENT OF AUTOMATED INFORMATION SYSTEMS AND DATA RESOURCES                                              | MANAGEMENT OF AUTOMATED INFORMATION SYSTEMS AND DATA RESOURCES                                              | C.

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Biometric Specifications for Personal Identity Verification:

n performance. A template generator is logically a converter of images to templates. A template matcher logically compares one or two templates with one or two templates to produce a similarity score.
Template generators and template matchers shall be certified separately. This aspect is instituted because:

Biometric Specifications for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Codes for Identification of Federal and Federally-Assisted Organizations:

ns Command              |
| 573G   | Air Force Elements, Europe                                       |
| 573I   | Reservist, Centrally Managed                                     |
| 573K   | HQ U.S.
European Command                                         |
| 573L   | Center for Air Force History                                     |
| 573M   | Air Force Elements, U.S. Southern Command                        |
| 573N   | Air Force Elements, U.S. Atlantic Command                        |
| 573O   | Air Force Elements, U.S. Pacific Command                         |
| 573Q   | Air Force Elements, U.S. Strategic Command                       |
| 573R   | Air Force Elements, U.S. Readiness Command                       |
| 573S   | Headquarters, U.S. Space Command and NORAD                       |
| 573T   | Air Force Elements U.S. Transportation Command                   |
| 573V   | Air Force Elements, Other than Europe                            |
| 573W   | Air Force Center for Environmental Excellence                    |
| 573Y   | Air Force Frequency Management Center                            |
| 573Z   | Joint Services Survival, Evasion, Resistance and Escape Agency   |

Codes for Identification of Federal and Federally-Assisted Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

es  to  mitigate  malicious  code  threats  are  outside  the  scope  of  this  document  (see [SP  800-53]  for  a  catalog  of  security  and  privacy  controls  for  federal  information  systems).
Malicious  code  could  be  introduced  into  PIN  capture  and  biometric  capture  devices for  the  purpose  of  compromising  or  otherwise  exploiting  the  PIV  Card. General  good practice  to  mitigate  malicious  code  threats  is  outside  of  the  scope  of  this  document (see  [SP  800-53]  for  a  catalog  of  security  and  privacy  controls  for  federal  information systems).

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Security for Full Virtualization Technologies:

The hypervisor is responsible for managing guest OS access to hardware (e.g., CPU, memory, storage). The hypervisor partitions these resources so that each guest OS can access its own resources but cannot encroach on the other guest OSs' resources or any resources not allocated for virtualization use. This prevents unauthorized access to resources and also helps prevent one guest OS from injecting malware into another, such as infecting a guest OS's files or placing malware code into another guest OS's memory. Separately, partitioning can also reduce the threat of denial of service conditions caused by excess resource consumption in other guest OSs on the same hypervisor. Guest OSs are often not completely isolated from each other and from the host OS because that would prevent necessary functionality. For example, many hosted virtualization solutions provide mechanisms called guest tools through which a guest OS can access files, directories, the copy/paste buffer, and other resources on the host OS or another guest OS. These communication mechanisms can inadvertently serve as an attack vector, such as transmitting malware or permitting an attacker to gain access to particular resources. Bare metal virtualization software does not offer such sharing capabilities. Another potential problem with increasing the use of virtualization in particular is the proliferation of images, also known as sprawl . It is easy to create a new image-it can often be done in just a few minutes, albeit without any consideration of security-so unnecessary images may be created and run. Each additional image running is another potential point of compromise for an attacker. Also, each additional image is another image that has to have its security maintained. Therefore, organizations should minimize the creation, storage, and use of unnecessary images.

Guide to Security for Full Virtualization Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to User's Guide to Telework and Bring Your Own Device (BYOD) Security:

4 OMB Memorandum 06-19, Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments, defines PII as 'any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother's maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.' The full text of the memorandum is available at http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-19.pdf.

Teleworkers should also be aware of how to handle threats involving social engineering , which is a general term for attackers trying to trick people into revealing sensitive information or performing certain actions, such as downloading and executing files that appear to be benign but are actually malicious. For example, an attacker might approach a teleworker in a coffee shop and ask to use the computer for a minute or offer to help the teleworker with using the computer. Teleworkers should be wary of any requests they receive that could lead to a security breach or the theft of a telework device. Teleworkers should ask their organizations for training regarding how to recognize and handle social engineering attempts, if such training is not already being provided.

User's Guide to Telework and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case provide? (Part 5)

[Assistant]
3, Revision 1 has been released, this implementation guide will be revised to include the updates in the Cybersecurity Framework Version 1.1 as well, and will be published as NISTIR 8183A, Revision 1.
## Table of Contents

| Executive Summary..................................................................................................... vi     | Executive Summary..................................................................................................... vi     | Executive Summary..................................................................................................... vi                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction ............................................................................................................1 | 1. Introduction ............................................................................................................1 | 1. Introduction ............................................................................................................1                                                                            |
| and Scope                                                                                | Purpose                                                                                | ........................................................................................

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

i | |----------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.0 | Privacy Framework Introduction..........................................................................................1 | | | | Overview of the Privacy Framework......................................................................................................2 | | | | Privacy Risk Management......................................................................................................................2 | | | 1.2.1 Cybersecurity and Privacy Risk Management...................................................................................3 | 1.2.1 Cybersecurity and Privacy Risk Management...................................................................................3 | | | 1.2.2 Privacy Risk Assessment....................................................................................................................4 | 1.2.2 Privacy Risk Assessment....................................................................................................................4 | | | | Document Overview..............................................................................................................................5 | | | 2.0 | Privacy Framework Basics....................................................................................................6 | | | | Core........................................................................................................................................................6 | | | | Profiles ...................................................................................................................................................8 | | | | Implementation Tiers ............................................................................................................................8 | | | 3.0 | How to Use the Privacy Framework.....................................................................................9 | | | | Mapping to Informative References......................................................................................................9 | | | | Strengthening Accountability ..............................................................................................................10 | | | | Establishing or Improving a Privacy Program ......................................................................................11 | | | | Applying to the System Development Life Cycle .................................................................................12 | | | | Using within the Data Processing Ecosystem ......................................................................................13 | | | | Informing Buying Decisions .................................................................................................................14 | | | References .........................................................................................................................................15 | References .........................................................................................................................................15 | References .........................................................................................................................................15 | | Appendix A: Privacy Framework Core.................................................................................................

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

| 1 INTRODUCTION.................................................................................................................
1                                                                                | 1 INTRODUCTION................................................................................................................. 1                                                                                |
| 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                | 2 REPORTING CONVENTIONS.......................................................................................... 2                                                                                |
| 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS............................................................................... 3                                                                                | 3 PROFESSIONAL DEMOGRAPHICS...............................................................................

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 2?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

## FIPS  PUB  201-3

## Federal Information Processing Standards Publication

## (Supersedes  FIPS  201-2)

## Personal  Identity  Verification  (PIV) of  Federal  Employees  and  Contractors

## Category: Information Security Subcategory: Identity

Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8900

This publication is available free of charge from: https://doi.org/10.6028/NIST.FIPS.201-3

Issued January 2022

<!-- image -->

## U.S. Department  of  Commerce

Gina  M. Raimondo,  Secretary

## National  Institute  of  Standards  and  Technology

James  K. Olthoff,  Performing  the  Non-Exclusive  Functions  and  Duties  of  the  Under  Secretary  of  Commerce for  Standards  and  Technology  &  Director,  National  Institute  of  Standards  and  Technology

## FOREWORD

The  Federal  Information  Processing  Standards  Publication  Series  of  the  National  Institute of  Standards  and  Technology  is  the  official  series  of  publications  relating  to  standards and  guidelines  adopted  and  promulgated  under  the  provisions  of  the  Federal  Information Security  Modernization  Act  (FISMA)  of  2014. Comments  concerning  Federal  Information  Processing  Standard  publications  are welcomed  and  should  be  addressed  to  the  Director,  Information  Technology  Laboratory, National  Institute  of  Standards  and  Technology,  100  Bureau  Drive,  Stop  8900, Gaithersburg,  MD  20899-8900. Charles  H. Romine,  Director Information  Technology  Laboratory

i

## ABSTRACT

Authentication  of  an  individual's  identity  is  a  fundamental  component  of  physical  and logical  access  control. An  access  control  decision  must  be  made  when  an  individual attempts  to  access  security-sensitive  buildings,  information  systems,  and  applications. An accurate  determination  of  an  individual's  identity  supports  making  sound  access  control decisions.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.3.1                                                                                | Program Size... 3.3.1 Program Size

Participants in both the focus groups and survey were asked how many people (including federal employees and contractors) were covered by the organization's security awareness program (i.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations:

2 Cryptographic binding is a methodology for providing integrity and authenticity to data and data relationships using wellknown cryptographic techniques. Cryptographic binding works by determining the hash value of each object attribute associated with a specific object and digitally signing the collection of hashed values. When the object is accessed, if the object signature fails, the attribute hash values are then compared to determine which element was modified since the last binding operation. Scalability, feasibility, and performance are important issues when considering the deployment of an ABAC product or technology. Enterprise ABAC-allowing an organization to have access to authorized objects managed by another organization in the same enterprise-requires complex interaction between ABAC components. Often these components are distributed throughout the enterprise across organization boundaries and sometimes on different networks. The larger and more diverse the enterprise, the more complex these interactions become. What may have been a simple request to access a document in a repository may now require a policy request from an enterprise service, multiple attributes from numerous logically and physically dispersed attribute sources, a third-party validation of the integrity of the object attributes bound to the document, and a decision made at one point in the enterprise while the enforcement of that decision occurs at a different point in the enterprise. Feasibility evaluation should check whether applications can support ABAC, either natively or through third-party applications. All of these potential interactions have a performance cost that must be evaluated when determining the scope of objects that may be shared through an enterprise ABAC implementation. To mitigate potential performance and scalability concerns, a variety of architectures should be considered.

Guide to Attribute Based Access Control (ABAC) Definition and Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Module-Lattice-Based Key-Encapsulation Mechanism Standard provide? (Part 4)

[Assistant]
systems used or operated by federal agencies or by a contractor of an agency or other organization on behalf of an agency. They do not apply to national security systems as defined in 44 U.S.C. 3552.
This standard, or other FIPS or NIST Special Publications that specify alternative mechanisms, shall be used wherever the establishment of a shared secret key (or shared secret from which keying material can be generated) is required for federal applications, including the use of such a key with symmetric-key cryptographic algorithms, in accordance with applicable Office of Management and Budget and agency policies. The adoption and use of this standard are available to private and commercial organizations. 7. Implementations. A key-encapsulation mechanism may be implemented in software, firmware, hardware, or any combination thereof. For every computational procedure that is specified in this standard, a conforming implementation may replace the given set of steps with any mathematically equivalent set of steps. In other words, different procedures that produce the correct output for every input are permitted. NIST will develop a validation program to test implementations for conformance to the algorithms in this standard. Information about validation programs is available at https: //csrc.nist.gov/projects/cmvp. Example values will be available at https://csrc.nist.gov/proj ects/cryptographic-standards-and-guidelines/example-values. 8. Other Approved Security Functions. Implementations that comply with this standard shall employ cryptographic algorithms that have been approved for protecting Federal Government-sensitive information. Approved cryptographic algorithms and techniques include those that are either:
2. (a) Specified in a Federal Information Processing Standards (FIPS) publication,
3. (b) Adopted in a FIPS or NIST recommendation, or
4. (c) Specified in the list of approved security functions in SP 800-140C. 9. Export Control.

Module-Lattice-Based Key-Encapsulation Mechanism Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

Information System Security Best Practices for UOCAVA-Supporting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0:

The national and economic security of the United States depends on the reliable functioning of critical infrastructure. Cybersecurity threats exploit the increased complexity and connectivity of critical infrastructure systems, placing the Nation's security, economy, and public safety and health at risk. Similar to financial and reputational risk, cybersecurity risk affects a company's bottom line. It can drive up costs and impact revenue. It can harm an organization's ability to innovate and to gain and maintain customers.

The Framework is not a one-size-fits-all approach to managing cybersecurity risk for critical infrastructure. Organizations will continue to have unique risks - different threats, different vulnerabilities, different risk tolerances - and how they implement the practices in the Framework will vary. Organizations can determine activities that are important to critical service delivery and can prioritize investments to maximize the impact of each dollar spent. Ultimately, the Framework is aimed at reducing and better managing cybersecurity risks.

The Framework is a living document and will continue to be updated and improved as industry provides feedback on implementation. As the Framework is put into practice, lessons learned will be integrated into future versions. This will ensure it is meeting the needs of critical infrastructure owners and operators in a dynamic and challenging environment of new threats, risks, and solutions.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Index of Automated System Design Requirements as Derived from the OMB Privacy Act Implementation Guidelines:

This index is a list of certain requirements which must be considered by Federal technical and administrative personnel in order to comply with those provisions of the Privacy Act of 1974* relating to automated systems design and development. This index has been derived from the Office of Management and Budget (0MB) guidelines** for implementing those provisions. Each requirement listed contains a reference to an applicable part of the Privacy Act and to a page and column number of the 0MB guidelines as they appear in the Federal Register . Therefore, these documents must be used in conjunction with this index. Furthermore, a familiarity with these documents will increase the utility of this index.

This index is a list of certain requirements which must be considered by Federal technical and administrative personnel in order to comply with those provisions of the Privacy Act of 1974* relating to automated systems design and development . This index has been derived from the Office of Management and Budget (0MB) guidelines** for implementing those provisions Each requirement listed contains a reference to an applicable part of the Privacy Act and to a page and column number of the 0MB guidelines as they appear in the Federal Register . Therefore, these documents must be used in conjunction with this index. Furthermore , a familiarity with these documents will increase the utility of this index.

Index of Automated System Design Requirements as Derived from the OMB Privacy Act Implementation Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium:

In the particular case under consideration, the AM equipment  was  delivered  to  the  'manufacturing' floor, unboxed and set up all without the awareness  of  the  IT  department.    Once  installed, the  AM  engineering  team  connected  with  the Enterprise  Help  Desk  and  requested  '…can  you help  connect  our  new  printer  to  the  network?' Unwittingly, the request was executed.  Needless to say, the original equipment manufacturer (OEM) was unable to connect to the  AM equipment,  since it was  behind  the corporate firewall.  Subsequent  requests  were  submitted  to the Enterprise Help Desk requesting OEM access to  the  equipment  through  the  Internet  for  finetuning.   The  printer  was  transferred  to  an  open Internet connection normally provided to corporate guests.  This channel is monitored yet it has minimal shielding. It was only after subsequent investigation by the information security team that it became clear that the 'printer' was  in  fact  a  metal  DDM  system,  not  a  typical office document printer. Following this discovery, the security team has moved the printer to a secure and scrutinized subnet  on  the  network.  Now, additional security controls and enhanced logging occur routinely and yet where it is still possible for the engineering team to work directly through the network with the manufacturer.

Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

## Access Control:

Access to IT and OT systems is based on the principle of least privilege depending on the user's role in the organization. Proper authorization and approval by the Director of Operations are required prior to granting access or operating any components of the manufacturing system. Controls are in place to restrict access through authentication methods and other technical means. Passwords are managed through a formal process and secure log-on procedures. Sensitive systems are explicitly identified and audited regularly.

1. Employees must complete cybersecurity awareness training and agree to uphold the acceptable use policy.
2. Employees must immediately notify the Director of Operations if an unescorted or unauthorized individual is found in the facility.
3. Employees must always use a secure password on all systems as per the password policy. These credentials must be unique and must not be used on other external systems or services.
4. Terminated employees must return all company records, in any format.
5. Employees  must  verify  with  the  Director  of  Operations  that  authorizations  have  been granted before allowing external personnel to connect to the IT or OT network.
6. Employees must report any physical or cybersecurity incidents to the Director of Operations.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities:

## Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1        | Executive Summary..............................................................................................................ES-1                                                                                | Executive Summary..............................................................................................................ES-1        |
|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Security Considerations for Voice Over IP Systems:

A careful assessment must be conducted to ensure that sufficient backup power is available for the office VOIP switch, as well as each desktop instrument.   Costs may include electrical power to maintain UPS battery charge, periodic maintenance costs for backup power generation systems, and cost of UPS battery replacement.  If emergency/backup power is required for more than a few hours, electrical generators will be required.  Costs for these include fuel, fuel storage facilities, and cost of fuel disposal at end of storage life.

electrical generators will be required.  Costs for these include fuel, fuel storage facilities, and cost of fuel disposal at end of storage life.

Security Considerations for Voice Over IP Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-05-06

## How to Cite this NIST Technical Series Publication

Megas, K, Fagan M, Cuthill B, Hoehn B , Petrella E (2025) Workshop Summary Report for 'Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' . (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8572. https://doi.org/10.6028/NIST.IR.8572

## Author ORCID iDs

Katerina Megas: 0000-0002-2815-5448

Michael Fagan: 0000-0002-1861-2609

Barbara Cuthill: 0000-0002-2588-6165

## Contact Information

iotsecurity@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8572/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This report summarizes discussions held at the March 5, 2025 "Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' organized by the NIST Cybersecurity for the Internet of Things (IoT) program.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.1 (NIST 3.6.1)?

[Assistant]
According to Guidelines on Securing Public Web Servers:

3.6.1                                                                                | Trusted Operating Systems... 3.6.1 Trusted Operating Systems

Trusted operating systems (TOS) are security-modified or -enhanced OSs that include additional security mechanisms not found in most general-purpose OSs.

Guidelines on Securing Public Web Servers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Computer Security Training & Awareness Course Compendium:

- GBA 560 | 79 | | MANAGING COMPUTER SECURITY-MERGERS S, ACQISITIONS, AND DIVESTITURES | 67 |

Computer Security Training & Awareness Course Compendium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Prioritizing Cybersecurity Risk for Enterprise Risk Management provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-02-24 Supersedes NIST IR 8286B (February 2022) https://doi.org/10.6028/NIST.IR.8286B

## How to Cite this NIST Technical Series Publication

Quinn SD, Ivy N, Barrett M, Witte GA, Gardner RK (2025) Prioritizing Cybersecurity Risk for Enterprise Risk Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency Report (IR) NIST IR 8286B-upd1. https://doi.org/10.6028/NIST.IR.8286B-upd1

## Author ORCID iDs

Stephen D. Quinn: 0000-0003-1436-684X Nahla Ivy: 0000-0003-4741-422X Matthew Barrett: 0000-0002-7689-427X Gregory A. Witte: 0000-0002-5425-1097

## Contact Information

nistir8286@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8286/b/upd1/final, including related content, potential updates, and document history. ## All comments are subject to release under the Freedom of Information Act (FOIA).

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice PE.L2-3.10.2 (NIST 3.10.2)?

[Assistant]
According to Recommendation for Key Management_ Part 1 – General:

3.10.2 Public Static Key Agreement Keys... 3.10.2 Public Static Key Agreement Keys

If an entity determines that the public static key-agreement key is lost or corrupted, the entity may recover in one of the following ways:

1. 3.10.2 to remove the impression that archiving is only performed after the  end  of  the  cryptoperiod  of  a  key  (e.

Recommendation for Key Management_ Part 1 – General


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Codes for Identification of Federal and Federally-Assisted Organizations:

| EXECUTIVE SUMMARY.................................................................................................................. | EXECUTIVE SUMMARY.................................................................................................................. |
|---------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|
| 1                                                                                | INTRODUCTION ....................................................................................................................

Codes for Identification of Federal and Federally-Assisted Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program:

An information security measurement program can increase accountability by helping organizations identify if specific controls that are implemented correctly, are not implemented, or are ineffective. The continuous feedback provided by a structured measurement program supports regular internal communications that collect data about information security performance and risks for high-level members of the organization. Implementing an information security measurement program demonstrates an organizational commitment to proactive information security and continuous improvement. For example, organizations that use the Cybersecurity Capacity Maturity Model (CMM) may implement a measurement program as part of the goal of demonstrating the Level 4, 'Managed,' degree of performance. When using the appropriate measures, an information security measurement program enables organizations to quantify improvements in securing systems and demonstrate quantifiable progress in accomplishing strategic goals and objectives. More information on selecting measures can be found in SP 800-55v1.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

--------|--------------|-------------------------------------------------------------|--------|
|           | Abstract     |                                                             | ii     |
| 1.
| Introduction | Introduction                                                | 1-1    |
|           | 1.1          | Background                                                  | 1-1    |
|           |              | 1.1.1 Trusted Computer System ^valuation Criteria (TCSEC)   | 1-2    |
|           | 1.1.2        | Information Technology Security Evaluation Criteria (TTSEC) | 1-2    |
|           |              | 1.1.3 Security Requirements in the Commercial Sector        | 1-3    |
|           |              | 1.1.4 System Security Study Committee                       | 1-4    |
|           |              | 1.1.5 Federal Criteria Project                              | 1-5    |
|           |              | 1.1.6 Minimum Security Requirements                         | 1-5    |
|           | 1.2          | Scope of the MSR                                            | 1-6    |
|           | 1.3          | Audience                                                    | 1-6    |
|           | 1.4          | Terminology                                                 | 1-7    |
|           | 1.5          | Document Organization                                       | 1-7    |
| 2.

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Forensic Filtering of Cell Phone Protocols:

Phone  managers  are  sometimes  turned  to  as  a  way  to  recover  data  when  no  suitable  forensic  tool  is available. Phone managers are typically available from the manufacturer of the cell phone and kept up to date with support for newly released models. They allow various operations, including retrieval of core user  data  such  as  phonebook  entries  and  photos. The  forensic  soundness  of  tools  not  designed specifically for forensic purposes are questionable, however [4]. In particular, phone managers have the ability to both read and write data to a phone, which is problematic from a forensic perspective, if used without  applying  proper  testing  and  procedural  controls. Many  anecdotes  exist  of  a  practitioner accidentally or unknowingly writing data to a phone when using such a tool. Cell  phone  manufacturers  such  as  Nokia,  Motorola,  and  Samsung  normally  keep  their  phone  manager software up to date for new and current phone models in the product line. Forensic specialists have long recognized the potential for phone managers as a tool for automated recovery of common types of core user data. Because phone managers are not forensically sound, additional steps must be followed to use them to recover data. They include validating the operation of the phone manager, testing and verifying the  procedures  to  be  followed  for  acquisition  to  safeguard  against  altering  data  on  the  phone,  and producing a cryptographic hash of acquired data objects. Initial testing of the two prototype implementations indicate that the approach could provide a practical and effective solution for addressing the latency in forensic tool coverage of available phones. The basic technique described is extendable beyond the specific phone manager examples given.

Forensic Filtering of Cell Phone Protocols


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to U.S. Department of Justice Simplified Risk Analysis Guidelines:

- a. The minimum security requirements for PCs, mainframes, minicomputers, and other remotely accessed AISs, and application systems are listed in Sections 3.1, 3.2, and 3.3 of the Appendix. The requirements of each of these sections are divided into requirements for nonsensitive, sensitive, and classified processing for Sections 3.1 and 3.2, and nonsensitive and sensitive applications for Section 3.3. The minimum security requirements are hierarchical in structure, so that requirements for processing lower sensitivity levels also are applicable to all higher sensitivity levels. - b. This step requires a review of the minimum security requirements as listed in the Appendix for the AIS or application under evaluation. The review also requires an evaluation of the effectiveness of the in-place security measures in meeting the security requirement. The person conducting the risk analysis must identify all security measures implemented to comply with the minimum security requirements, assess their effectiveness in meeting the requirement, and document the results. Any of the minimum requirements that are not met will be addressed in Step 5 where the selection of additional countermeasures will be considered. 1. Description of Sensitivity and Criticality of Data Processed
2. -Based on Tables 2 & 3
3. -Threats to data. 2. Risk Analysis (RA)
5. -Date of last RA. 6. -Person or contractor conducting RA. 7. -Methodology used. 8. -Action taken on recommendations. 9. -RA documentation. 3. Contingency Plans (CPs). 11. -Emergency response, back-up, and recovery for large systems
12. -Status of plans. 13. -Documentation of CP. 14. -Used or tested (date)
4. Description of Security Measures. - a. Physical Security. 17. -Locks, guards, detection systems. 18. -Fire and environmental hazards. - b. Personnel Security. 20. -Background investigations. 21. -Security clearances. - c. Administrative Procedures. 23. -Issuance of implementing security directives. 24.

U.S. Department of Justice Simplified Risk Analysis Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

| 1. Introduction...................................................................................................................................1   |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Fundamentals ................................................................................................................................4     |
| 3. Measurement Considerations.......................................................................................................12                |
| 3.1.1. Measures Documentation..........................................................................................................12             |
| 3.1.2. Measurement Reporting ............................................................................................................14           |
| 3.1.3. Data Management......................................................................................................................14        |
| 3.1.4. Data Quality................................................................................................................................15 |
| 3.1.5. Uncertainty and Errors ...............................................................................................................15       |
| 3.3.1. Implementation Measures.........................................................................................................17             |
| 3.3.2. Effectiveness Measures..............................................................................................................17         |
| 3.3.3. Efficiency Measures....................................................................................................................18      |
| 3.3.4.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions provide? (Part 3)

[Assistant]
. Category of Standard : Computer Security Standard, Cryptography. 3. Explanation :  This  Standard  (FIPS  202)  specifies  the  Secure  Hash  Algorithm-3  (SHA-3) family of functions on binary data.
Each of the SHA-3 functions is based on an instance of the KECCAK  algorithm  that  NIST  selected  as  the  winner  of  the  SHA-3  Cryptographic  Hash Algorithm  Competition. This  Standard  also  specifies  the  KECCAKp family  of  mathematical permutations,  including  the  permutation  that  underlies  KECCAK,  which  can  serve  as  the  main components of additional cryptographic functions that may be specified in the future. The  SHA-3  family  consists  of  four  cryptographic  hash  functions  and  two  extendable-output functions (XOFs). The cryptographic hash functions are called SHA3-224, SHA3-256, SHA3384, and SHA3-512; and the XOFs are called SHAKE128 and SHAKE256. For hash functions, the input is called the message , and the output is called the (message) digest or  the hash  value . The  length  of  the  message  can  vary;  the  length  of  the  digest  is  fixed. A cryptographic  hash  function  is  a  hash  function  that  is  designed  to  provide  special  properties, including collision resistance and preimage resistance, that are important for many applications in  information security. For example, a cryptographic hash function increases the security and efficiency of a digital signature scheme when the digest is digitally signed instead of the message itself. In  this  context,  the  collision  resistance  of  the  hash  function  provides  assurance  that  the original message could not have been altered to a different message with the same hash value, and  hence,  the  same  signature. Other  applications  of  cryptographic  hash  functions  include pseudorandom bit generation, message authentication codes, and key derivation functions.

SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Technical Guide to Information Security Testing and Assessment provide?

[Assistant]
<!-- image -->

## Technical Guide to Information Security Testing and Assessment

## Recommendations of the National Institute of Standards and Technology

Karen Scarfone Murugiah Souppaya Amanda Cody Angela Orebaugh

## NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment

Recommendations of the National Institute of Standards and Technology

Karen Scarfone Murugiah Souppaya Amanda Cody Angela Orebaugh

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

September 2008

<!-- image -->

U.S. Department of Commerce

Carlos M. Gutierrez, Secretary

National Institute of Standards and Technology

Dr. Patrick D. Gallagher, Deputy Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-115 Natl. Inst. Stand. Technol. Spec. Publ. 800-115, 80 pages (Sep.

Technical Guide to Information Security Testing and Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

software at all times. Set it to automatically scan emails and flash drives. - o Continuously monitor directory services (and other primary user stores) for indicators of compromise or active attack.
- o Block access to untrusted web resources. Use products or services that block access to server names, IP addresses, or ports and protocols that are known to be malicious or suspected to be indicators of malicious system activity. This includes using products and services that provide integrity protection for the domain component of addresses (e.g., hacker@poser.com).

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

- a. National Organizations . As presented in Exhibit 1-1, the NASA Automated Information Security Program is based on public laws promulgated by Congress. The following organizations then issued national policies, standards, and guidelines:
2. (1)
3. The Department of Commerce (DOC)
- (2) The National Institute for Standards and Technology (NIST)
5. (3)
6. The Office of Management and Budget (0MB)
7. (4)
8. (5)
9. (6)
10. The Office of Personnel Management (0PM)
11. The National Security Agency (NSA)
12. The Department of Defense (DOD)
- (7) The General Services Administration (GSA)
- (8) Various Presidential committees on computer and telecommunications systems security. - b. National Documents . National policy and guidance documents include:
16. (1)
17. (2)
18. (3)
19. Computer Security Act of 1987 (PL 100-235)
20. Executive Order 12356. 21. 0MB Circular A-130. - (4) NIST Federal Information Processing Standards (FIPS) Publications. 23. (5)
24. DOD guidance on protecting classified information. 25. (6)
26. NSA guidance on trusted computer systems. - where multiple organizational levels or program area applications exist, Assistant PO-CSM*s and/or CSC*s may be designated to accomplish specific computer security responsibilities. - (3) Implement and coordinate an appropriate management oversight process that ensures awareness and compliance with applicable portions of NMI 2410.7 and this Handbook in cognizant organizations
- (4) Assure that all NASA and appropriate NASA contractor computing and telecommunications resources processing NASA information are identified and included under the management of a DPI. - (5) Assure that, through the contracting officer, all appropriate contractors are required to comply with applicable provisions of NMI 2410.7 and this Handbook. - (6) Review and concur on exceptions from implementing specific requirements of this Handbook. - e. Other Headquarters Offices .

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry:

security, and physical security increases with C-SCRM practice maturity. More mature companies have explicit roles that bridge these functions and also integrate them with enterprise risk management.
Such internal alignment facilitates the efficiency and effectiveness of delivering products and services while appropriately managing C-SCRM risks. For example, these integrated functions share information, metrics, and program objectives to reduce C-SCRM risks. This often results in a more nuanced and comprehensive understanding of cybersecurity risks by business executives, as well as better strategic decisions that take CSCRM into consideration.

Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface:

3.2.3. 3.2.3.

Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

Federal CKMS service-using organizations should coordinate with their service-providing organization in defining and supporting security policies for providing key-management services for their users.
|
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| PA:4.3   | A Federal CKMS service provider should have a Computer Security Policy. |
| PA:4.4   | A Federal CKMS service-using organization should create a Computer Security Policy that identifies: a) The information that is processed, communicated, and stored within its computer systems that requires protection, b) The threats that are to be protected against, and c) The detailed rules for protecting the information by computers, communication systems, and computer users. |
| PA:4.5   | A Federal CKMS should use and support applications using computer operating systems that provide security in accordance with the FCKMS service-using organization's Computer Security Policy. |

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh:

Deployment architecture in cloud-native applications now consists of loosely coupled components,  called  microservices,  with  all  application  services  provided  through  a  dedicated infrastructure, called a service mesh, independent of the application code. Two critical security requirements in this architecture are to build (1) the concept of zero trust by enabling mutual authentication  in  communication  between  any  pair  of  services  and  (2)  a  robust  access  control mechanism based on an access control such as attribute-based access control (ABAC) that can be used to express a wide set of policies and is scalable in terms of user base, objects (resources), and deployment  environment.  This  document  provides  deployment  guidance  for  building  an authentication and authorization framework within the service mesh that meets these requirements. A reference platform for hosting the microservices-based application and a reference platform for the service mesh are included to illustrate the concepts in the recommendations and provide the context in terms of the components used in real-world deployments.

attribute-based access control; authentication policy; authorization policy; CI/CD; DevSecOps; JSON web token; microservices-based application; mutual TLS; next generation access control; policy enforcement point; role-based access control; service mesh; service proxy; zero trust.

The authors express their sincere thanks to Mr. David Ferraiolo of NIST for initiating this effort to provide a targeted deployment guidance in the form of an authentication and authorization framework in a service mesh environment used for protecting microservices-based applications. They also express thanks to Isabel Van Wyk of NIST for her detailed editorial review.

Attribute-based Access Control for Microservices-based Applications using a Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

6.1  Special-Risk  Security  Provision. The  U.S. Government  has  personnel,  facilities, and  other  assets  deployed  and  operating  worldwide  under  a  vast  range  of  threats  (e.g., terrorist,  technical,  intelligence),  the  severity  of  which  is  particularly  heightened  overseas. For  cardholders  with  particularly  sensitive  threats  while  outside  of  the  contiguous  United States,  the  issuance,  holding,  and/or  use  of  PIV  credentials  with  full  technical  capabilities as  described  herein  may  result  in  unacceptably  high  risk. In  such  cases  of  risk  (e.g.,  to facilities,  individuals,  operations,  national  interest,  or  national  security)  by  the  presence and/or  use  of  full-capability  PIV  credentials,  the  head  of  a  department  or  independent agency  may  issue  a  select  number  of  maximum-security  PIV  credentials  that  do  not contain  (or  otherwise  do  not  fully  support)  the  wireless  and/or  biometric  capabilities otherwise  required/referenced  herein. To  the  greatest  extent  practicable,  heads  of departments  and  independent  agencies  should  minimize  the  issuance  of  such  special-risk security  PIV  credentials  so  as  to  support  interagency  interoperability  and  the  President's policy. Use  of  other  risk-mitigating  technical  (e.g.,  high-assurance  on/off  switches  for the  wireless  capability)  and  procedural  mechanisms  in  such  situations  is  preferable  and, as  such,  is  also  explicitly  permitted  and  encouraged. As  protective  security  technology advances,  the  need  for  this  provision  will  be  reassessed  when  the  Standard  undergoes  the normal  review  and  update  process. Federal  departments  and  agencies SHALL use  the  credentialing  eligibility  standards issued  by  the  Director  of  the  Office  of  Personnel  Management  (OPM) 3 and  OMB.

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Using Business Impact Analysis to Inform Risk Prioritization and Response provide? (Part 5)

[Assistant]
both federal and nonFederal Government corporate officers, high-level executives, ERM officers and staff members, and others who understand ERM but may be unfamiliar with the details of cybersecurity.
All readers are expected to gain an improved understanding of how CSRM and ERM complement and relate to each other as well as the benefits of integrating their use. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................3 |
| 2. Cataloging and Categorizing Assets Based on Enterprise Value ........................................................6                           |
| 3.

Using Business Impact Analysis to Inform Risk Prioritization and Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case provide?

[Assistant]
## NISTIR 8183A Volume 2

## Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide:

Volume 2 -Process-based Manufacturing System Use Case

Keith Stouffer Timothy Zimmerman CheeYee Tang Jeffrey Cichonski Michael Pease Neeraj Shah Wesley Downard

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-2

<!-- image -->

## NISTIR 8183A Volume 2

## Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide:

Volume 2 -Process-based Manufacturing System Use Case

Keith Stouffer Timothy Zimmerman CheeYee Tang Michael Pease Intelligent Systems Division Engineering Laboratory

Neeraj Shah

Strativia, LLC Largo, Maryland

Jeffrey Cichonski Applied Cybersecurity Division Information Technology Laboratory

Wesley Downard G2, Inc. Annapolis Junction, Maryland

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-2

September 2019

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

## National Institute of Standards and Technology Internal Report 8183A, Volume 2 353 pages (September 2019)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-2

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

Program managers, system owners, and security personnel in the organization must understand the system security planning process. In addition, users of the information system and those responsible for defining system requirements should be familiar with the system security planning process. Those responsible for implementing and managing information systems must participate in addressing security controls to be applied to their systems. This guidance provides basic information on how to prepare a system security plan and is designed to be adaptable in a variety of organizational structures and used as reference by those having assigned responsibility for activity related to security planning.

The roles and responsibilities in this section are specific to information system security planning. Recognizing that agencies have widely varying missions and organizational structures, there may be differences in naming conventions for security planning-related roles and how the associated responsibilities are allocated among agency personnel (e.g., multiple individuals filling a single role or one individual filling multiple roles 4 ).

- Develops and maintains information security policies, procedures, and control techniques to address system security planning,
- Manages the identification, implementation, and assessment of common security controls,
- Ensures that personnel with significant responsibilities for system security plans are trained,
- Assists senior agency officials with their responsibilities for system security plans, and
- Identifies and coordinates common security controls for the agency.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

| 4-4                                                                            |
| 4.8 Security Standards for Multi-Vendor                              | Systems . . .
.4-4                                                             |
| 4.9 Closing Thoughts                                                 | 4-5                                                                            |
| LIST APPENDICES                                                      | APPENDIX A-1                                                                   |
| APPENDIX APPENDIX A: LIST OF ORGANIZATIONS B: SAMPLING OF JOB TITLES | APPENDIX B-1                                                                   |
| APPENDIX C: SAMPLE                                                   | QUESTIONS APPENDIX C-1                                                         |
| APPENDIX D: RELATED NIST ACTIVITIES AND                              | SOURCES OF INFORMATION APPENDIX D-1                                            |

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Program Review for Information Security Management Assistance (PRISMA):

MA Review is based upon the Software Engineering Institute's (SEI) former Capability Maturity Model (CMM), where an organization's developmental advancement is measured by one of five maturity levels.
This approach was incorporated into the Federal CIO Council's Federal Information Technology Security Assessment Framework of 2000 and PRISMA, which also employ five maturity levels where the fifth maturity level represents the highest developmental level of the information security program. The levels are listed in increasing maturity as follow:

Program Review for Information Security Management Assistance (PRISMA)